Method serveHtmlWithConfig

server/src/http.ts:870–912

* Serve an HTML file with APP_CONFIG injected. * This ensures clean URL routes (like /membership) get the same config injection * as .html file requests handled by the middleware.

(req: express.Request, res: express.Response, htmlFile: string)

   * as .html file requests handled by the middleware.
   */
  private async serveHtmlWithConfig(req: express.Request, res: express.Response, htmlFile: string): Promise<void> {
    const publicPath = process.env.NODE_ENV === 'production'
      ? path.join(__dirname, "../server/public")
      : path.join(__dirname, "../public");
    const filePath = path.join(publicPath, htmlFile);

    try {
      // Cross-domain session bridge for AdCP pages
      if (this.bridgeIfNeeded(req, res)) return;

      // Get user from session (if authenticated), passing res to update cookie if session is refreshed
      const user = await getUserFromRequest(req, res);
      await enrichUserWithMembership(user);
      await enrichUserWithAdmin(user);

      // Read and inject config
      let html = await fs.readFile(filePath, 'utf-8');
      const configScript = getAppConfigScript(user);

      // Inject before </head>
      if (html.includes('</head>')) {
        html = html.replace('</head>', `${configScript}\n</head>`);
      } else {
        // Fallback: inject at start of body
        html = html.replace('<body', `${configScript}\n<body`);
      }

      res.setHeader('Content-Type', 'text/html');
      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
      res.setHeader('Pragma', 'no-cache');
      res.setHeader('Expires', '0');
      res.send(html);
    } catch (error) {
      const nodeError = error as NodeJS.ErrnoException;
      if (nodeError.code === 'ENOENT') {
        logger.warn({ htmlFile }, 'HTML file not found');
        res.status(404).send('Not Found');
      } else {
        logger.error({ error, htmlFile }, 'Failed to serve HTML with config');
        res.status(500).send('Internal Server Error');
      }
    }
  }

  private setupRoutes(): void {
    // Authentication routes (only if configured)